SC-900 Multiple Select — 40 Questions

Question 1

A company must comply with the General Data Protection Regulation (GDPR). They need a unified solution that provides a compliance score, actionable recommendations to improve their security posture, and the ability to track their progress over time. Additionally, they want to assign improvement actions to specific teams and automate the collection of evidence for controls. Which two Microsoft Purview solutions should the administrator use? (Select two.)

Accepted Answer

Compliance Manager. Compliance Manager is correct because it provides a unified compliance score, actionable recommendations to improve security posture, and the ability to track progress over time. It also allows administrators to assign improvement actions to specific teams and automate evidence collection for controls, directly meeting all the stated GDPR compliance requirements.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 2

A company uses Microsoft Entra ID. They need to implement a Conditional Access policy for the finance application that requires multifactor authentication (MFA) when a user accesses the app from an unmanaged device. Additionally, they want to block access if the sign-in risk level is high. Which two grant controls should they configure in the policy? (Select two.)

Accepted Answer

Require multi-factor authentication. Option A is correct because the scenario explicitly requires multifactor authentication (MFA) when a user accesses the finance application from an unmanaged device. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control enforces MFA as part of the policy, directly meeting this requirement. Option B is correct because the scenario also requires blocking access if the sign-in risk level is high. The 'Block access' grant control is the appropriate control to deny authentication when a high-risk sign-in is detected, as it overrides any other grant controls.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Question 3

A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)

Accepted Answer

Verify explicitly. Option A is correct because the 'Verify explicitly' principle of Zero Trust requires that every access request must be fully authenticated, authorized, and encrypted before granting access. This means using strong authentication mechanisms (e.g., multifactor authentication) and continuous validation of identity and device health, not just relying on network location or implicit trust.

Answer

Network segmentation

Question 4

An organization uses a system where users first provide a username and password (Step 1) and then the system checks whether the user has permission to view a specific folder (Step 2). Which two security concepts are demonstrated in this process? (Choose two.)

Accepted Answer

Authentication. Step 1 (username and password) is authentication, which verifies the identity of the user by validating credentials against an identity provider such as Azure AD or on-premises Active Directory. This confirms who the user is before any access decisions are made.

Answer

Accounting

Answer

Encryption

Question 5

A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 6

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Accepted Answer

Physical security of the datacenters. In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Answer

Patching the guest operating system on the VM

Answer

Configuring network security group (NSG) firewall rules

Question 7

A security team is using Microsoft Entra ID Protection. They want to automatically block sign-ins from known malicious IP addresses, but if a user's account is compromised (e.g., leaked credentials), they want to force the user to change their password upon next sign-in. Which two risk policies should they configure? (Select all that apply.)

Accepted Answer

Sign-in risk policy set to 'Block access' for High risk. Option A is correct because the sign-in risk policy in Microsoft Entra ID Protection can be configured to automatically block access when a sign-in is detected as high risk, such as from a known malicious IP address. This policy evaluates real-time risk signals during authentication and enforces the specified action (e.g., 'Block access') without requiring additional Conditional Access policies.

Answer

MFA registration policy

Answer

Conditional Access policy with a custom block rule

Question 8

A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

A sensitivity label with encryption settings. Option A is correct because a sensitivity label must include encryption settings to automatically encrypt documents when the label is applied. The encryption is configured within the label's protection settings, which defines how content is protected (e.g., with a predefined template or user-defined permissions). Without encryption configured in the label, the automatic application would only assign the label without encrypting the document.

Answer

A DLP policy that detects sensitive info

Answer

A data classification dashboard

Question 9

A security administrator wants to use Microsoft Defender for Cloud to protect Azure VMs. Which two of the following should be enabled to meet the requirements? (Choose two.)

Accepted Answer

Just-in-Time (JIT) VM access. Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, only opening ports (e.g., RDP 3389, SSH 22) when requested and for a limited time after approval via Microsoft Defender for Cloud. This directly protects Azure VMs by preventing persistent exposure of management ports.

Answer

Azure Bastion

Answer

Vulnerability assessment

Question 10

A user logs into a company portal by entering a username and password. After successful login, the system checks if the user is a member of the 'Sales' group and then grants access to the sales dashboard. Which two security concepts are demonstrated in this process? (Choose all that apply.) (Choose two.)

Accepted Answer

Authentication. Authentication is demonstrated because the user proves their identity by providing a username and password, which the system verifies before allowing access. This is the process of validating credentials, typically against a directory service like Azure AD or an on-premises Active Directory, confirming the user is who they claim to be.

Answer

Non-repudiation

Answer

Accounting

Question 11

A user logs into a company's financial application using their Microsoft Entra ID credentials. After successful sign-in, the application displays a dashboard with data for only the regions the user is authorized to manage. Which two security concepts are demonstrated in this scenario? (Select all that apply.)

Accepted Answer

Authentication. Authentication is demonstrated because the user proves their identity by logging in with Microsoft Entra ID credentials, confirming they are who they claim to be. Authorization is demonstrated because after authentication, the application restricts the dashboard to show only data for regions the user is permitted to manage, enforcing access control based on assigned permissions.

Answer

Accounting

Answer

Non-repudiation

Question 12

A company requires users to enter a password and then a temporary code from a mobile app to sign in. After signing in, a user attempts to open a confidential document but is denied because they are not a member of the 'Managers' group. Which two security concepts are primarily demonstrated in this scenario?

Accepted Answer

Authentication and Authorization. The scenario demonstrates two distinct security concepts: authentication and authorization. The password plus temporary code from a mobile app (a form of multi-factor authentication) verifies the user's identity, which is authentication. The subsequent denial of access to the confidential document because the user is not a member of the 'Managers' group is authorization—the process of determining what resources an authenticated user is permitted to access. In Microsoft Entra ID, authentication is handled via token issuance (e.g., SAML or OAuth 2.0), while authorization is enforced through role-based access control (RBAC) or directory role assignments.

Answer

Encryption and Hashing

Answer

Accounting and Auditing

Question 13

A company implements a security policy where employees must use a smart card to log into their workstations. After logging in, they can only access file shares that correspond to their department. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The smart card login verifies the user's identity, which is authentication. The subsequent restriction to department-specific file shares controls what resources the user can access, which is authorization. Together, these two steps demonstrate the security concepts of authentication (proving who you are) and authorization (determining what you can do).

Answer

Identification and accounting

Answer

Confidentiality and integrity

Question 14

An organization stores sensitive customer data in a cloud database. The security team uses encryption to protect the data while it is stored and while it is transmitted. They also implement role-based access control to ensure only authorized users can modify the data. Which two security principles are primarily being upheld by these actions?

Accepted Answer

Confidentiality and integrity. Encryption at rest and in transit directly protects the confidentiality of sensitive customer data by preventing unauthorized access. Role-based access control (RBAC) ensures that only authorized users can modify the data, which upholds integrity by preventing unauthorized or accidental changes. Together, these actions primarily uphold the security principles of confidentiality and integrity.

Answer

Availability and integrity

Answer

Privacy and accountability

Question 15

A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The fingerprint scan is a form of authentication, verifying the user's identity through a biometric factor. The subsequent check of the user's group membership ('Data Analyst') to grant access to the database is authorization, determining what resources the authenticated user can access. This scenario directly maps to the identity and access management (IAM) concepts of authentication (proving who you are) and authorization (what you are allowed to do).

Answer

Identification and non-repudiation

Answer

Availability and accountability

Question 16

Which THREE are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to Azure VMs. It uses Network Security Group (NSG) rules to allow access only when requested by an authorized user, for a specified time window, and from a specific IP address. This prevents persistent open management ports like RDP (TCP 3389) or SSH (TCP 22) from being exposed to the internet.

Answer

DDoS protection

Answer

SIEM and security orchestration

Question 17

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Accepted Answer

Block access from locations that are not trusted. Options A and C are correct. A: Conditional Access can require MFA based on conditions. C: It can block access from untrusted locations. Options B, D, and E are incorrect: B is a benefit of passwordless; D is a benefit of SSPR; E is a benefit of PIM.

Answer

Allow users to reset their own passwords

Answer

Automatically grant temporary admin access

Answer

Eliminate the need for passwords entirely

Question 18

Which THREE of the following are features of Microsoft Entra ID Governance? (Select three.)

Accepted Answer

Access reviews. Access reviews are a core feature of Microsoft Entra ID Governance, enabling administrators to periodically review and certify user access rights to ensure they remain appropriate. This supports compliance, security, and lifecycle management by automating attestation workflows.

Answer

Self-service password reset

Answer

Multifactor authentication

Question 19

Which THREE are benefits of using Microsoft Entra ID as an identity provider? (Choose three.)

Accepted Answer

Conditional Access policies. Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. Conditional Access policies (B) are a core feature that allow you to enforce access controls based on signals like user, location, and device state, making it a direct benefit of using Entra ID as an identity provider.

Answer

Web application hosting

Answer

Centralized database management

Question 20

Which THREE features are included in Microsoft Entra ID Free? (Choose three.)

Accepted Answer

Security reports and alerts. Option A is correct because Microsoft Entra ID Free includes basic security reports and alerts that provide insights into sign-in activities and potential risks, such as sign-ins from unfamiliar locations or devices. These reports are part of the built-in Identity Security Reports, which are available at no additional cost in the Free tier.

Answer

Self-service password reset with on-premises writeback

Answer

Conditional Access